thoughtbot/paperclip — Issue #663: Temporary path is exposed when uploading unauthorized extension
Author: khuenping
Created: 2011-12-02 16:56:58+00:00
State: open

Using Rails 3.1.0. I have the following in my User.rb:

# Avatar sizes
has_attached_file :avatar,
:styles => {:large => "180x180>",
:large => "150x150",
:medium => "100x100",
:small => "50x50#",
:mini => "30x30#"},
:default_url => "avatar/:style.jpg"

# Validation
validates_attachment_content_type :avatar, :content_type => ['image/jpeg', 'image/jpg', 'image/png']
validates_attachment_size :avatar, :less_than => 5.megabyte

When I upload an authorized content type, it works, but when I try to upload a wrong content type, e.g. xxx.html, it throws these errors:

Sorry, 5 errors found. Please revise the following:

Profile picture /var/folders/98/98oirn+CEqe8kUvutfmsUk+++TI/-Tmp-/stream20111203-84004-6vwaw6.html is not recognized by the 'identify' command.
Profile picture /var/folders/98/98oirn+CEqe8kUvutfmsUk+++TI/-Tmp-/stream20111203-84004-6vwaw6.html is not recognized by the 'identify' command.
Profile picture /var/folders/98/98oirn+CEqe8kUvutfmsUk+++TI/-Tmp-/stream20111203-84004-6vwaw6.html is not recognized by the 'identify' command.
Profile picture /var/folders/98/98oirn+CEqe8kUvutfmsUk+++TI/-Tmp-/stream20111203-84004-6vwaw6.html is not recognized by the 'identify' command.
Avatar content type is not one of image/jpeg, image/jpg, image/png

It exposes the path of the temporary directory. I cannot find way to customize these error messages. My suggestion is either we can hide these messages, or we can customize these messages.

Reminder: My imagemagick is working fine when a correct image is uploaded.

Please advise. Thanks.